> The logic is the following (see also the last patch for some more > documentation): > - hid-bpf first preloads a BPF program in the kernel that does a few > things: > * find out which attach_btf_id are associated with our trace points > * adds a bpf_tail_call() BPF program that I can use to "call" any > other BPF program stored into a jump table > * monitors the releases of struct bpf_prog, and when there are no > other users than us, detach the bpf progs from the HID devices > - users then declare their tracepoints and then call > hid_bpf_attach_prog() in a SEC("syscall") program > - hid-bpf then calls multiple time the bpf_tail_call() program with a > different index in the jump table whenever there is an event coming > from a matching HID device So driver abstractions like UDI are now perfectly fine as long as they are written using a hip new VM? This whole idea seems like a bad idea, against the Linux spirit and now actually useful - it is totally trivial to write a new HID driver alreay, and if it isn't in some cases we need to fix that. So a big fat NAK to the idea of using eBPF for actual driver logic.